Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-03-2024 12:44
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240226-en
General
-
Target
file.exe
-
Size
649KB
-
MD5
b9a42052c81229de87b90370c7e8ef56
-
SHA1
8253ef8fe65f68ea7e0cc11bcdc06ec91c8d3290
-
SHA256
2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b
-
SHA512
0e6a1b3d66c2401f8b8d5f8b2cae7d4912fa73565faf4c21686caa63a0d81eda952d6070edb57e7577c15c896caff3e52a6671713cfaa13ed21bab7accb86755
-
SSDEEP
12288:tOSF/ZdMP5WlYj6Fs/HI6C96D7cyTZ33a33S333333dkS9Jy9:tLrMPkDFB6+2NkeO
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Default
5.182.87.154:4449
jiqsvporltpvroy
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
-
PureLog Stealer payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4092-1-0x0000023AABEC0000-0x0000023AABF0C000-memory.dmp family_purelog_stealer -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
file.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dzodxh = "C:\\Users\\Admin\\AppData\\Roaming\\Dzodxh.exe" file.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 4092 set thread context of 1468 4092 file.exe file.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
file.exepid process 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe 1468 file.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
file.exefile.exedescription pid process Token: SeDebugPrivilege 4092 file.exe Token: SeDebugPrivilege 1468 file.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
file.exepid process 1468 file.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
file.exedescription pid process target process PID 4092 wrote to memory of 1468 4092 file.exe file.exe PID 4092 wrote to memory of 1468 4092 file.exe file.exe PID 4092 wrote to memory of 1468 4092 file.exe file.exe PID 4092 wrote to memory of 1468 4092 file.exe file.exe PID 4092 wrote to memory of 1468 4092 file.exe file.exe PID 4092 wrote to memory of 1468 4092 file.exe file.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\file.exeC:\Users\Admin\AppData\Local\Temp\file.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1468